For time-series multi updates, the spool stage could use memory exceeding the limit and would need to spill to disk. By default, we allow queries and commands to spill to disk if necessary. But if users would like to fail early on their (potentially mistakenly wrong) non-selective updates, we want to provide them a more fine-control way to do so per command.